Secrets on Automate everything

Secrets hide in your Git history, even after you delete them

sebastian@graef.io (Sebastian Gräf) — Tue, 23 Jun 2026 10:00:00 +1000

You committed an API key by accident. You notice, delete the line, commit again, and push. Crisis averted, right? No. That key is still sitting in your git history, one git log -p away from anyone who clones the repo. A new commit only adds a layer on top. It never removes the old one.

The Silent Leak: Why You Should Never Paste Keys into AI Chats

sebastian@graef.io (Sebastian Gräf) — Wed, 18 Feb 2026 16:59:37 +1000

You’re debugging a failing API call. Frustrated, you paste your key straight into the chat with GitHub Copilot or Claude to get a faster answer. Feels harmless, right? It’s not. And the problem goes deeper than you think, your AI assistant might already be reading your .env file without you even knowing.